2. Who Am I
• Software Developer and Security Engineer
@ Parallels Automation
• Open source developer
• Mail: adedov@gmail.com
• Twitter: @brutemorse
3. Motivation
• It is hard for application developers to choose
between existing password meters reasonably.
• Worse, some implement their own [or
customize existing] without understanding of
security and psychological implications.
• Need some framework/criteria that would
help reasonable choice.
3
5. Untargeted Online Attacks
User base
Common
passwords
100 K
• 1 guess per user / day
• 2 days to find first password
• 100 days to find 50 passwords
10 K
100 K
2.5 K
5K
• 1 guess per user / day
• 10 days to find first password
• 1.5yr to find 50 passwords
6. Targeted Online Attacks
•
•
•
•
•
10 failed attempts 1 hour block
240 attempts per user / day
7200 attempts per user / month
86400 attempts per user / year
More IP-s scale linearly
7. Offline Attacks
• Huge dictionaries
• Specialized hardware and clusters
• No time/complexity limitations except
– Enforced password quality
– Hash speed
– Salt uniqueness
7
10. Method
•
•
•
•
Apply meters to password bases
Dictionary attacks with JtR
Rule-based attacks with JtR
Collect essential parameters
11. Apply Meters
• Requirement: meter should provide
unambiguous signal about if password is
accepted or not.
• Passwdqc tells straight “OK” or “Bad”.
• Others return score. Minimal accepted score
documented.
11
16. Cracking Sessions
• 25 attacks per password base per meter
• Min dictionary size 817
• Max dictionary size 396M
RockYou dictionary was not used against RockYou password base.
16
17. Parameters
• M – passwords approved by meter
• D – attack dictionary size
• C – # of guessed passwords during attack
• Attack effectiveness
• Attack economy
C
M
C
D
17
29. Conclusions
•
•
•
•
Test your security tools for security
Avoid write your own security tools
All tested meters protect from online attacks
Also seem protect from offline attacks
(for slow hashes and unique salts)
• But most tend to deny more passwords than it
is necessary, including known to be hard ones
• Passwdqc and zxcvbn look best
30. Where to go?
• Bigger dictionaries and brute force
• Testing on real people to
– Learn evolution of “common passwords” lists
– Test psychological acceptance empirically
• More meters?
30
